Discover the secrets of bug bounty hunting and breaking into the cybersecurity industry! Our blog offers expert tips, real-world experiences, and valuable insights for newcomers aiming to succeed.
Discovered by: Michael KimVendor: ui-lib (Uilibrary)Product: Stocky – POS with Inventory Management & HRM (“Ultimate Inventory Management System with POS”)Affected Version: 5.0 (as released June 2025)Impact: Arbitrary JavaScript Execution (Stored XSS...
Discovered by: Michael Kim & Sergio MedeirosVendor: iNiLabsProduct: School Express – School Management System (SMS Express)Affected Version: 6.2 (other versions not tested)Impact: Arbitrary JavaScript Execution (Stored XSS)Attack Type: Remote (Authen...
Discovered by: Michael Kim & Sergio MedeirosVendor: LiquidThemesProduct: MagicAI (a.k.a. MagicProject AI)Affected version: 9.1 (other versions untested)Impact: Arbitrary JavaScript execution in users’ browsers (stored XSS)Attack type: Authenticated r...
Introduction: As a seasoned cybersecurity researcher and penetration tester, I am constantly on the lookout for certifications that sharpen my skills and keep me at the forefront of web application se
Late one night, after working on a couple of bug bounty platforms, I decided to revisit a CVE I found last month. I realized that the web application had implemented the Summernote WYSIWYG Editor, which was the root cause of the stored XSS vulnerabil...
Late in the evening, I decided to explore some PHP applications focused on Student Information Systems, inspired by my recent success in finding systemic stored XSS vulnerabilities in a private bug bounty program. I visited my favorite source for PHP...
It was late at night, and I was starting to burn out from hunting bugs in a few bug bounty programs I am active on. I still had that hacker itch I wanted to scratch, so I decided to look at a few web applications to see if I could find any easy "0day...
I was scrolling through LinkedIn and noticed a couple of hackers on my newsfeed posting that they passed the mock exam for the CAPen Certification by The SecOps Group. This caught my interest because I had never heard of the Certified AppSec Penteste...
Usually, when newcomers approach me in the bug bounty field, they often ask about the tools, methods, and any other "secret sauce" I use when searching for vulnerabilities in bug bounty programs. I'm sure many of them might feel I sound arrogant or c...
While enumerating the scope of a target on a private bug bounty program, I came across a subdomain used for generating PDF files. However, it seemed out-of-scope as they were simply white labeling a service called PDFMyURL, which lets you convert any...
Since I began my journey of becoming a professional "hacker" and bug bounty hunter, I've always been fascinated by researchers who hunt and look for zero days in web applications. I've envied them, as I felt that having CVEs tied to your name as a se...
Finally! As promised, I am sharing my tips and tricks on how to pass the eWPTXv2 exam by INE and eLearnSecurity on your first attempt, using nothing but free resources. This exam is by far the hardest exam that I have taken to date, and I thought it ...
I began my journey pursuing a cyber security career professionally about a year ago, with the focus on obtaining only hands-on practical certifications with the intent to pivot careers after a decade-long run in Sales. Currently, I have obtained the ...
I started my journey with practical certifications in the Cyber Security world because I have been trying to pivot careers after being in technical sales in the Fintech space for nearly a decade. After obtaining my eJPT and eCPPTv2 certifications, I ...
While doing some basic recon, and digging through subdomains on various targets on different bug bounty platforms and VDP's, I came across something interesting hanging around on the Pizza Hut domain that peaked my interest. Looking at the authentica...